HTTP Headers Analysis for https://groupon.ca

Detected Technologies from Headers

See all in URL Inspect 3

Akamai

Envoy

Express

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=2628000

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Excellent

DENY

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Content-Type-Options: nosniff
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close, Transfer-Encoding

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding, User-Agent

connection: close, Transfer-Encoding
transfer-encoding: chunked
vary: Accept-Encoding, User-Agent

Caching Headers

Cache-Control

Caching

private, max-age=0, no-cache, no-store, must-revalidate

cache-control: private, max-age=0, no-cache, no-store, must-revalidate

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

X-Powered-By

Server

Express

x-powered-by: Express

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: division=gatineau_en; Max-Age=157680000; Expires=Tue, 25 Feb 2031 07:25:24 GMT; Path=/; Domain=.groupon.ca
user_locale=en_CA; Max-Age=34186464; Expires=Sun, 28 Mar 2027 23:39:48 GMT; Path=/; Domain=.groupon.ca; Secure
b=dba3ea7c-fa36-4c59-a3ea-7cfa36fc598e; Max-Age=315360000; Expires=Sun, 24 Feb 2036 07:25:24 GMT; Path=/; Domain=.groupon.ca
s=521870fb-462e-4586-9870-fb462ec5862a; Max-Age=1800; Expires=Thu, 26 Feb 2026 07:55:24 GMT; Path=/; Domain=.groupon.ca
ipll=%7B%22lat%22%3A%2239.047%22%2C%22lng%22%3A%22-77.490%22%2C%22ip%22%3A%22216.246.40.66%22%7D; Path=/; Domain=.groupon.ca; Secure
sigFraudCheck=d3cb0cfe-758c-4078-8b0c-fe758cb0788d; Max-Age=86400; Expires=Fri, 27 Feb 2026 07:25:24 GMT; Path=/; Domain=.groupon.ca
_csrf=jtI9wWF661lrmtGyd-0vrhFk; Path=/; Secure; HTTPOnly
pageId=521870fb-462e-4586-9870-fb462ec5862a-1772090723981-TH0; Max-Age=34186464; Expires=Sun, 28 Mar 2027 23:39:48 GMT; Path=/; Domain=.groupon.ca; Secure
_abck=4E3BEFAE7AFA89FC14D469D7986EF9FA~-1~YAAQXU5OaGVX9oecAQAA65LWmA/2L93Zl8zxl5bV3yK/9f02bb0Yl7Amv8ZalXQYQYI0IRNqWTiQHPq/3i5U/+kdGkOmfk3GdFpnpGyFqENzr0Pp9Kk9NIhyGvBTsJiO1v3lt6RcbK08VFOeiXHHjiUJ3q6kmPn1AzqJIedDFdwEEte4UyXU+WxpR9g9tXiAHFn3iTHaCOuMi3cSp8GDFLgz08DKmQlLxRnLFpuYvOpkS/UMmluCIsmqvMWhs3Cg0h1v0oQp+j4DmyHUBH5kGwTHsfcG5uJSE9yvz/TzqsmvtO/sc8GIcndZ55jRRVX9t6x6kVbl9rFjR2fvbj873cN+440cX4N7K7zL1/ACplN4VoEQS/ioRXBkcp6W5HmZOZCM07+MhIr6oVTYUnKkYKtAKA+j0fr3a420fFyO1EJ/zGnD7KpSXJ9Z/MqPiWlUlttnTQ0=~-1~-1~-1~-1~-1; Domain=.groupon.ca; Path=/; Expires=Fri, 26 Feb 2027 07:25:25 GMT; Max-Age=31536000; Secure
bm_sz=197CE22139281362BA9416E95D766E3C~YAAQXU5OaGZX9oecAQAA65LWmB526SU215sb1jwUnTEp0DlyUhCrgRgSZDWsBElW1w1dPs0vkXp1cYLbsEgjIpdl0IMeh3vhw5l5aR1JJRTAK4gE+Mzc/kZ32FSx1v3Q8A9eJRsgFFIrKssD4uOfour5ps2uRqFS8jSne8yJkAijdpOxg9/FEW636uQlCM9fX5ldcw0U0/wK3FUTlXiaxWLqZtbBaApxI8YBbMR1u44SyQCWZp6YK+5ut/FEuxIvU7bOiWfPVrqO7C8mvJlAXOZKWRQ7+km8Cc0VvBuwvi7DNTTIqp4vrGm5m++dbX6ZvpSNP0usrL8UQ4Jqxk23+HibiTy0NXan12cQfCFI~3360070~3552056; Domain=.groupon.ca; Path=/; Expires=Thu, 26 Feb 2026 11:25:23 GMT; Max-Age=14398

Other Headers

Date

Other

Thu, 26 Feb 2026 07:25:25 GMT

Link

Other

URL https://www2.grouponcdn.com/browse/assets/home_desktop-f7805b283e.css

rel=preload as=style

URL https://www2.grouponcdn.com/browse/assets/home_desktop-7509b6ffb1.js

rel=preload as=script

Server-Timing

Other

rReq;dur=965, rCon;dur=0, rHdr;dur=966, hbi;dur=941

X-Akamai-Transformed

Other

0 - 0 -

X-Application

Other

Pull-Itier

X-B-Cookie

Other

dba3ea7c-fa36-4c59-a3ea-7cfa36fc598e

X-B3-Traceid

Other

0fbc311352a24929b53ac2d3f3756987

X-Destination

Other

tls_conveyor_pull_itier

X-Envoy-Upstream-Service-Time

Other

966

X-External-Request-Id

Other

true

X-Forwarded-Proto

Other

https, https

X-Mtls-Upstream-Time

Other

941

X-Original-Request-Id

Other

0fbc3113-52a2-4929-b53a-c2d3f3756987, 0fbc3113-52a2-4929-b53a-c2d3f3756987

X-Page-Id

Other

521870fb-462e-4586-9870-fb462ec5862a-1772090723981-TH0

X-Request-Id

Other

0fbc3113-52a2-4929-b53a-c2d3f3756987,0fbc3113-52a2-4929-b53a-c2d3f3756987

X-Request-Originated-From

Other

envoy-tls-side-car--ingress-https

X-Response-Served-From

Other

pull--eu-west-1--default--conveyor-production49, routing-service--public--eu-west-1--conveyor-production49

X-S-Cookie

Other

521870fb-462e-4586-9870-fb462ec5862a

X-Signifyd-Cookie

Other

d3cb0cfe-758c-4078-8b0c-fe758cb0788d

X-Ua-Compatible

Other

IE=edge,chrome=1

date: Thu, 26 Feb 2026 07:25:25 GMT
link: <https://www2.grouponcdn.com/browse/assets/home_desktop-f7805b283e.css>; rel=preload; as=style, <https://www2.grouponcdn.com/browse/assets/home_desktop-7509b6ffb1.js>; rel=preload; as=script
server-timing: rReq;dur=965, rCon;dur=0, rHdr;dur=966, hbi;dur=941
x-akamai-transformed: 0 - 0 -
x-application: Pull-Itier
x-b-cookie: dba3ea7c-fa36-4c59-a3ea-7cfa36fc598e
x-b3-traceid: 0fbc311352a24929b53ac2d3f3756987
x-destination: tls_conveyor_pull_itier
x-envoy-upstream-service-time: 966
x-external-request-id: true
x-forwarded-proto: https, https
x-mtls-upstream-time: 941
x-original-request-id: 0fbc3113-52a2-4929-b53a-c2d3f3756987, 0fbc3113-52a2-4929-b53a-c2d3f3756987
x-page-id: 521870fb-462e-4586-9870-fb462ec5862a-1772090723981-TH0
x-request-id: 0fbc3113-52a2-4929-b53a-c2d3f3756987,0fbc3113-52a2-4929-b53a-c2d3f3756987
x-request-originated-from: envoy-tls-side-car--ingress-https
x-response-served-from: pull--eu-west-1--default--conveyor-production49, routing-service--public--eu-west-1--conveyor-production49
x-s-cookie: 521870fb-462e-4586-9870-fb462ec5862a
x-signifyd-cookie: d3cb0cfe-758c-4078-8b0c-fe758cb0788d
x-ua-compatible: IE=edge,chrome=1

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology